VLANs

Introduction

At AppNexus every customer has a private VLAN, or Virtual Local Area Network in each datacenter where they operate equipment. Your VLAN is a list sequential of IP addresses that can be assigned to the instances you launch on the AppNexus system. VLAN can consist of 8, 24, 56 or 120 IP addresses (eight addresses in each range are reserved for networking equipment so they can act as if belonging to an individual VLAN). This VLAN provides security by segregating each customer's traffic from AppNexus and other customers' traffic and controlling traffic from the Internet via customer-controlled Access Control List (ACL).

ACLs

By default we deny all inbound traffic from the Internet to your IP block except for ping (ICMP Echo---used to verify that the host is up). Initial access rules are configured based on the customer questionnaire.

For incoming traffic, customer may request ACL (Access Control Lists) change: for TCP/UDP/ANY, for particular source and destination IPs and ports, request ALLOW or DENY rule. Default rule is deny all explicitly permitted traffic is allowed to pass.

You will be assigned a separate VLAN in each datacenter where you have equipment. By default, all ports between your two VLANs in different datacenters will be open. Traffic between LAX1 and NYM1 travels over the Internet and is not encrypted.

If you run out of IP addresses in your VLAN.

Assignment of new VLANs could take up to workday, as it involves changes in ACL rules for all your VLANs. As we assign second VLAN temporarily (just for the migration time), you'll have to migrate instances from the old VLAN to the new one. This doesn't require instance downtime, you'll get detailed instructions on the migration from Support when second VLAN is created.

We will have an API for ACLs. Also the portal.
Relevant tickets: #4128 /#4625/#3952

What about instructions:

1. When you launch new instance, please use "--ip" flag of "manage-instance launch" command to explicitly declare IP address of instance in new address block. – Really it'll be part of instruction – Vladimir

Meanwhile I'll prepare instructions on how to deal with multi-VLAN environment, how to migrate instances from old IP space to the new one with the existing API/CLI functionality, et cetera. – Actually Alexander Novitskiy is communicating with GiftReal (RT:5483) and OpenAds (RT:5118) on this.